Quantum states representing perfectly secure bits are always distillable 
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It is proven that recently introduced states with perfectly secure bits of cryptographic key (private 
states representing secure bit) [K. Horodecki et al., Phys. Rev. Lett. 94, 160502 (2005)] as well 
as its multipartite and higher dimension generalizations always represent distillable entanglement. 
The corresponding lower bounds on distillable entanglement are provided. We also present a simple 
alternative proof that for any bipartite quantum state entanglement cost is an upper bound on 
distillable cryptographic key in bipartite scenario. 
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I. INTRODUCTION 



For a long time quantum cryptography with entangle- 
ment discovered by Ekert [l[ has been developed based on 
pure quantum entanglement as a central resource. More 
precisely the schemes (see Ref. 0) existing in this do- 
main were equivalent to entanglement distillation Q . Re- 
cently it has been shown that entanglement which is not 
distillable (bound entanglement) can provide a quantum 
cryptographic key [J] . This leads to a general scheme of 
key distillation from quantum states [4, 5] with a private 
state representing a secure bit (alternatively: a private 
bit state or private bit) as an important notion. The 
latter is a quantum state shared by Alice and Bob that 
contains at least one bit of perfectly secure cryptographic 
key. Quite nonintuitively, private bits can be approx- 
imated arbitrary well by some bound entangled states 
in some special sense: there exist a sequence of private 
bits with dimension of their "shield" part going to in- 
finity and another sequence of bound entangled states 
such that trace distance between elements of the two se- 
quences goes to zero [1, Q • Here we show that despite 
of that fact any single private bit is distillable. Using lo- 
cal filtering Q in a way exploited in Ref. 0] we provide 
a lower bound on the corresponding distillable entangle- 
ment of d-dimensional private state (d-dimensional gen- 
eralization of p-bit). Note that the special (bipartite) 
case of our result has already found an important appli- 
cation in a proof of unconditional cryptographic security 
with small distillable entanglement [8| . Finally we give a 
simple alternative proof that for any bipartite state en- 
tanglement cost Ec (see Refs. d,[I3|) is an upper bound 
on amount of a distillable cryptographic key Krj (usually 
called distillable key). Originally this was proven 0, H| 
from the fact that regularized entropy of entanglement 
is an upper bound for Krj. We provide a simpler 
version that does not need to refer to E^ . 



II. LOWER BOUNDS ON DISTILL ABILITY 
A. Distillation of entanglement from private bits 

For purely pedagogical reasons at the very beginning 
we shall derive the lower bound on distillable entangle- 
ment of private bits. This is the starting point for more 
general classes of secure states as ci-dimensional private 
states and their multipartite counterparts. 

Let us recall the definition of private bit 0, Q . This is 
the bipartite state with internal structure of both Alice 
and Bob systems. It is defined on four-partite Hilbert 
space Haba'B' — Ha ®Hb <£> Ha' ®H.b' with subsys- 
tems denoted by A and A' (B and B') belonging to Al- 
ice (Bob). The first pair of subsystems shared by Alice 
and Bob is of qubit structure, i.e., Hab = Ha <8> H.b ~ 
C 2 <£> C 2 , while the second one has in general the form 
Ha'B' =H A '®Hb> ~ C d * ® C dB ' ■ The explicit form of 
private bit is 



= ~(3) 

Iaba'B' — 7 



£ \nm^U iPA , B ,U], (2.1) 
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where is the standard two-qubit product basis in 

Hab , PA' b> denotes some state acting on H. a> B' and Ui 
(i = 0, 1) are some unitary operations. The structure of 
private bit can be divided into two parts p|. The first 
one (AB) called key part is the one from which Alice and 
Bob can get a bit of secure key after local measurements 
in the standard bases. The second part (A'B') is called 
shield part (in the case of approximate private bits this 
part in a sense "defends" the key in system AB from 
an eavesdropper in the asymptotic regime [5]). We must 
stress that the private bit contains the perfectly secure 
bit of key while it can be approximated by bound en- 
tangled states in the sense that there exist a sequence of 

(2) 

private bits yi with the dimension of their shield parts 

T~Caib' g° m S to infinity and another sequence of bound 
entangled states qu such that for any e there exist k such 

that ||7fe — f?fc|| < e. The latter has been proven to 
imply that a bound entangled state can contain secure 
bit up to arbitrary precision measured by e in the sense 



2 



that the eavesdropper information about the shared bit is 
bounded by some continuous function of e that vanishes 
for e = (see Ref. @). In general one has a perfectly 
secure bit (no Eve's knowledge about the bit) for e = 0, 
i.e., when the observers share just a private bit. It turns 
out that this exact case can never happen when the ob- 
servers are given bound entanglement since, according to 
main result of the present paper, a private bit is always 
distillable. 

Having reviewed the structure of 7^, we can start a 
description of distillation protocol. We define the follow- 
ing parameter 



/; = max 



ei 



®{h\UvPA>B>Ul\e 2 )®\h 



(2.2) 



where the maximum is taken over all normalized product 
vectors \e\) ® \ f\) and |e 2 ) ® I/2) belonging to Ha'B'- 
One immediately infers that 



?7 > max 

m,n— 0,. . . ,d A r — 1 
0, . . . ,d B r —1 



UoPA'B'Ul 



>o, 



where strict positivity follows from the fact that the ma- 
trix representation [UopA>B'Ul] mfJ-tnL , of the nonzero op- 
erator UoPA'B'Ul in standard basis must have at 
least one nonzero element. Let |ei) ® and |e2) <S> I/2) 
be product vectors from TIa'B' for which the maximum 
in (12.211 is achieved. Then we define numbers 



a s = (e s \ <g> (f,\U a - X p A ' B >Ul_ 1 \e a ) ® \f s ) (s = 1,2). 

These numbers are always positive and the square root 
of their product is bounded from below by 77 (see Ref. 
fill]). Now we are in a position to show the distillability 
of 7^ 2 - ) . Let us assume that a 2 > a-i > 0. Then we define 
local operators: 

V AA - = |0> <0j ® (ei| + ,/^e i0 |l)(l| ® (g a |, 

V a 2 



with 



and 



= are 



ei 



(fi\U oP A>B>Ut\e 2 )®\f: 



Pbb> = |0><0|<8> (A| + |1><1|® (/ 2 |. 

The above operators can be used in LOCC operation 
of two-way type. The operation (called two-way local 
filtering) produces with probability ai > the state: 



V AA - ® Pbb'Iaba'B'VIa' ® p < 



BB' 



Tr 
p|*+)<* 



Vaa' <8> Pbb'7aba'b' V aa' 



PIb> 



(2.3) 



with p = (1/2) (1 + 77/^/0702) and two Bell states \ i f?±) = 
(1/V2)(|00) ± 1 1 1> ) . Distillable entanglement of two- 
element mixture of Bell states is known to be [HI, EH 



E D (g) = 1-H(p), where H (p) = -plogp-(l-p) log(l- 
p) and can be achieved in the so-called hashing pro- 
tocol 13]. If ai > 0,2 one applies the same procedure 
with only one modification, i.e., putting the local filter 
WaA' = \J a 2l ' o.\&~ iQ Vaa' in place of Vaa 1 ■ The result- 
ing state is equal to the same mixture of Bell states (|2.3[) 
as in the previous case, but the probability of its pro- 
duction is now ai . Combining these two observations we 
have the lower bound on distillable entanglement of 7^: 



, 2 2^/aia 2 



(2.4) 



where the factor a max = max[ai,a2] is maximum of two 
probabilities of production of the considered two-qubit 
Bell states mixture. It should be emphasized that r\ > 
and therefore the Shannon entropy in (|2.4p is less than 
one, which results in strict positivity of right-hand 
side of (|2.4[) . Thus a bipartite private bit is always a 
distillable state. 



B. Distillability of multipartite p-dits 

Here we shall provide a generalization of the result 
to any multipartite version of a bipartite d-dimensional 
private state (hereafter denotes by Jaba'B' or shortly 
by 7^)) 0,(1]. Multipartite d-dimensional private states 
play a natural role in the generalized scheme of distilla- 
tion of a secure key in a multipartite scenario (l4| . As 
mentioned, the special case of the present result, i.e., the 



one has already been applied in an unconditional 



security proof with a small distillable entanglement @ . 

A multipartite <i-dimcnsional private state is a natural 
generalization of the private bit (|2.ip both in the "size" 
of the key part (increased for any local observer from 
dimension 2 to d; this leads to logci of secure bits of 
key [H) and in the number of observers involved [14] ]: 
from two observers Alice (AA') and Bob (BB') to N ones 
{(AiA'^), (A 2 Ai 2 ), . . . , (A N A' N )}. It obviously reproduces 
the bipartite d-dimensional private state [J] in case of 
two observers. The form of multipartite (A^-partite) d— 
dimensional private state is 



.(d) 

AA' 



d-l 

Ei 

i,3=0 



.i){j...j\®U i Q A ,U], 



The above state is defined on a Hilbert space 7Yaa' = 
Ha ® H A - = (H Al (8 ... (8 H An ) ® (H A [ ® • • • ® Ha> n )- 
Here the system A = A\ . . . Ajv is of d® N type (one has 
N systems of d-level type instead of two systems of qubit 
type) with the standard basis {\ii . . . in}}- The density 
matrix Qa , 1 ...A' n acting on a Hilbert space TIa- is respon- 
sible for the shield part of ri?, and, as previously, Ui 
(i = 0, . . . , d — 1) are certain unitary evolutions. 

The distillation scheme may be found using similar 
techniques as for private bits. Therefore for fixed i and 
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j (i < j, t,j = 0,...,d—l) let us define 

77 fe) = max ® . . . (fNpiQA'U^gi) . . . ® | ffA r) 

(2.5) 

where maximum is taken over all product vectors from 
7Ya' • Similarly as in the private bit case we also define 



and 



® 1/^) 



1.9 



® l/^) and |jf ^ 



are 



where l/i ) § 

vectors realizing a maximum in Eq. I|2.5p . In a full anal- 
ogy to the case of a private bit, one checks that (cf. [Tlj ]) 

< rf l i} < *J a 2 % ^ ■ Again, if for a given pair of 

indices {i,j} (i < j) one has a 2 ij) > af j) > 0, we define 



V. 



m i 



,(y) /„W)„i©« 



b')01«)<5i 



where 



0y = arg 



( / r ) i...(/^V i :^c/ji#' ) )...i^ ) ; 



while in the case > a^, > we take W A ^ A , = 

\/ a 2 ^ I e _l0y V^ 3 ^/ . Finally we introduce 

A =K)(^</f ) l + li)(il®(9f ) l (fc = 2,...,iV). 

In both cases for given i and j (i < j), we shall obtain 

(if) 

the same state but with different probabilities, a\ in the 

first case and a 2 i n the second one. The corresponding 
LOCC filtering performed by all N parties (the first party 

uses V A ^ A , or W A ^\, while all the others apply P A ^ A i in 



full analogy to the formula 



e W) =p(«|ffe-))(#W)| + (i_ p WJ)|^w)(^w| ) (2.6) 

which is the mixture of two projectors onto GHZ states 
\¥^) = (l/V2)(|i...i)±|j...i))withpW) = (1/2) [1 + 

?7 (y ' ) /(a!j 1 M, 2) ) 1/2 ]- Using the GHZ distillation hashing 
protocol pjf (which is a generalization of that from pj|) 
and taking into account the fact that here one has only 
the so-called phase error (corresponding to the sign ± in 
the above formula) we get lower bound for the distillation 

rate of the GHZ states from T^, in the scenario with 
chosen filtering corresponding to a fixed pair of indices 
{i, j} as below 



finally gives the state 



a D V 1 AA' I — "max 




with a m ax being the bigger from two numbers a± and 
a 2 ^ . Again, since all are positive the above lower 
bounds are strictly positive too, which results in distill- 
ability of GHZ from any multipartite d-dimensional pri- 
vate state. Since we can optimize over choices of {i,j} 
we get the final lower bound on distillable entanglement 

of r (rf) 

Ui 1 AA' 



i,j=0 d- 

(*<?') 



which again is strictly positive since, as previously 

~ (ij) 

proven, all quantities E D are strictly positive. 

The above protocols are working for any dimensions 
d. However, for d > 4, further generalization of effi- 
ciency of distillation protocol can be introduced. This 
is because all local projections are here two-dimensional. 
It is easy to generalize the above scheme in such a way 
that instead of single filtering of that type we perform 
POVM involving k filterings (2k > d) which are locally 
orthogonal in the sense that their supports (subspaces on 
which they give nonzero results) are disjoint. Each of the 
results corresponding to fcth result of POVM would pro- 
duce some mixture of type (|2.6[) . Such a scheme would 
be, to some extent, analogous to distillation of entan- 
glement from mixtures of locally orthogonal states pjj 
which was independently analyzed also in [17] . 



III. BOUND ON DISTILLABLE KEY: AN 
ALTERNATIVE PROOF 

In this section we come back again to the bipartite 
scenario. We bound from above the amount of a distil- 
lable cryptographic key Kd(q) of any given state g by 
its entanglement cost Ec(g)- This fact has already been 
proven in Ref. [j| through the regularized relative en- 
tropy of entanglement. The present proof has a more 
direct character and is based on the well-known facts 
from the theory of entanglement measures [l(J. It also 
exploits the special structure of the eigenvectors of the 
bipartite d-dimensional private states. 

The crucial role is played here by the asymptotic conti- 
nuity of entanglement of formation [l3| proved by Nielsen 
[HI and the fact that the entanglement cost which has 
a rather complicated definition (see [10() may be related 
to entanglement of formation in a simple way by 0] 



Ec(p) = lim 



E F (p® m ) 



(3.7) 



for any given state p. Moreover, for these two measures 
we have E(A(p)) < E(p) with A being some LOCC pro- 
tocol pi]. 

At the very beginning we show that entanglement of 
formation of i'aba'B 1 El corresponding here just to bi- 
partite version of T^, with d being the dimension of 7i A 
(equivalently TIb), may be bounded from below by logd. 
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This can be obtained simply by utilizing the definition 
of entanglement of formation which for a given density 
matrix p acting on the Hilbert space Ha <£> T~Cb reads 

E F (p) = min Vp,S V N (Tr B |*i)(*i|) , 

where the minimum is taken over all ensembles {pi, 
generating the state p and SVn stands for the von Neu- 
mann entropy [20| . 

Consider now the state "/aba'B'- O ne ma y easily see 
that all its eigenvectors corresponding to nonzero eigen- 
values are 

1 d-i 

1^) = ~7=Jl\n)® u ^i A ' B ' ] ) 

j=o 

3=0 

An arbitrary vector from any ensemble {pi, \ re- 
alizing the considered state must be a linear combination 
of the above eigenvectors \^k) ■ This is a consequence of 
the fact, proved in Ref. [21(, that the vector be- 
longs to Ran7^ d ', which in turn is a subspace spanned 
by eigenvectors \ij)k)- Therefore it is not difficult to see 

that = (i/V3)Ej^ lii) ® l£j£ B ' } ) must hold for 

some vectors \<p\ k B '). Entanglement of formation of the 
vector can be easily estimated 

(l*<» = SvnCIWI I) = 

> logd, 

where S^,' = Trs/|0^' B ''}{^-^' B Since this holds 

for any vector from any ensemble of 7^, we have, by the 
very definition of Ep, the following 

Property 1. For any p-dit state one has 

E F (j {d} ) > log A (3.8) 

Note by the way that, by inspection, one can see that 
tensor product (^( d ))® m has a structure of 7^) type. 
Hence, a straightforward application of (|3.7[) to 

7 (d) i n 

place of g together with the above inequality leads to a 
stronger result, namely one has 

Property la. For any p-dit state 7" one has: 

E c {i {d) ) >\ogd. 

Now we are in position to relate Kp> and Eq- Suppose 
that Alice and Bob share n copies of a given bipartite 
state q with Kd{q) > (for states with Kd{q) = the 
inequality is trivially true). Consider the optimal proto- 
col distilling Kd{q) secret bits from q which is a sequence 
of LOCC protocols A„ (n e N) such that A„(p®") = 
and \\a^ — 7 < - d "'||Tr < e n for sequence of private states 



-y(dn) w ith the key part AB defined on the Hilbert space 
C rf " ® C dn . The sequence {e„} is supposed to converge 
to zero with increasing n. Since the protocol is optimal 
we have by definition [5| Kp>(g) — lim„(log d n /n). 

On the other hand the asymptotic continuity of Ep 
together with its monotonicity under LOCC protocol im- 
plies the following inequalities: 

l E p(a^) < I J e F ( (T («))+ ceri iogd„ + ^ 

n n n 

< l E p(g^)+ce n \ogd n + --^ 
n n 

for some constant c and o(e„) vanishing faster than e„ in 
the limit of large n. Combining this with (|3.8[) one has 

n n n n 

Taking the limit on both sides, utilizing Eq. (|3.7p . and 
exploiting the fact that Kp> = lim„ (log d n /n), we get 
finally the desired inequality that can be stated as follows 
(see [J, Q for alternative proof): 

Property 2. For any bipartite state Q 

K d {q) < E c {q). 

This immediately implies Kd{q) < Ep(g) since Ep ma- 
jorises Ec- 

IV. CONCLUSIONS 

We have proven that any (i-dimensional private state, 
i.e., state that contains logd bits of perfectly secure key 
is distillable and we have provided the explicit LOCC op- 
erations of distillation protocol. This result has already 
been applied by other authors [8J] in a proof of uncondi- 
tional security with small distillable entanglement. We 
have also provided the analogous result for a multipar- 
tite version of (i-dimensional private state which is a par t 
of general scheme for distillation of multipartite key [lj] . 
The results imply immediately that although from bound 
entanglement one can produce arbitrary secure bit of key 
(Eve's knowledge can be made arbitrarily small) , the lat- 
ter can never be perfectly secure (Eve's knowledge can 
not be made equal to zero). Finally exploiting the struc- 
ture of eigenvectors of p-bits we have provided an ele- 
mentary alternative proof of the fact that entanglement 
cost is an upper bound on the amount of distillable key 
of any quantum state. 
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